From 063f00b7427aabf08df8240760b29410270e314c Mon Sep 17 00:00:00 2001
From: dhruv8sh <dhruv8sh@proton.me>
Date: Thu, 5 Nov 2026 19:03:58 +0530
Subject: [PATCH 1/5] Run js_asset_proxy attribute rewriter before
 plan-registered integrations

---
 crates/trusted-server-core/src/auction/mod.rs |  63 ++++++++
 crates/trusted-server-core/src/config.rs      | 102 ++++++++++++-
 .../src/integrations/js_asset_proxy.rs        |  54 +++++++
 .../src/integrations/mod.rs                   |   5 +-
 .../src/integrations/prebid.rs                | 135 ++++++++++--------
 .../src/integrations/registry.rs              |  19 +++
 6 files changed, 315 insertions(+), 63 deletions(-)

diff --git a/crates/trusted-server-core/src/auction/mod.rs b/crates/trusted-server-core/src/auction/mod.rs
index 4323039284..853bb9e894 100644
--- a/crates/trusted-server-core/src/auction/mod.rs
+++ b/crates/trusted-server-core/src/auction/mod.rs
@@ -230,4 +230,67 @@ mod plan_sharing_tests {
 
         assert!(registry.has_route(&http::Method::GET, "/integrations/aps/renderer"));
     }
+
+    #[test]
+    fn js_asset_proxy_rewriter_runs_before_plan_registered_rewriters() {
+        // `create_test_settings` enables Prebid; add an APS profile, GPT and
+        // `js_asset_proxy` so plan registrations precede the builder table.
+        let mut settings = create_test_settings();
+        settings.auction.providers = std::collections::BTreeMap::from([(
+            "aps-main".parse().expect("should parse APS provider ID"),
+            ProviderConfig {
+                protocol: "openrtb-2.6".to_string(),
+                profile: "aps".to_string(),
+                endpoint: "https://aps.example/e/pb/bid".to_string(),
+                timeout_ms: None,
+                routing: RoutingMode::AllEligible,
+                notifications: NotificationConfig::default(),
+                profile_config: serde_json::json!({"account_id":"example-account"}),
+            },
+        )]);
+        settings
+            .integrations
+            .insert_config("gpt", &serde_json::json!({ "enabled": true }))
+            .expect("should insert GPT config");
+        settings
+            .integrations
+            .insert_config(
+                "js_asset_proxy",
+                &serde_json::json!({
+                    "enabled": true,
+                    "assets": [{
+                        "path": "/assets/vendor.js",
+                        "origin_url": "https://cdn.example.com/vendor.js"
+                    }]
+                }),
+            )
+            .expect("should insert JS asset proxy config");
+        let plan = Arc::new(compile_auction_plan(&settings).expect("should compile APS plan"));
+
+        let registry =
+            IntegrationRegistry::with_plan(&settings, plan).expect("should build registry");
+
+        assert!(
+            registry.integration_enabled("aps") && registry.integration_enabled("prebid"),
+            "should register APS and Prebid from the plan"
+        );
+        let ids = registry.attribute_rewriter_ids();
+        assert_eq!(
+            ids.first(),
+            Some(&"js_asset_proxy"),
+            "js_asset_proxy should be the first attribute rewriter: {ids:?}"
+        );
+        let prebid_index = ids
+            .iter()
+            .position(|id| *id == "prebid")
+            .expect("should register Prebid attribute rewriter");
+        let gpt_index = ids
+            .iter()
+            .position(|id| *id == "gpt")
+            .expect("should register GPT attribute rewriter");
+        assert!(
+            prebid_index < gpt_index,
+            "other rewriters should keep registration order: {ids:?}"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/config.rs b/crates/trusted-server-core/src/config.rs
index 059d500092..d084de4212 100644
--- a/crates/trusted-server-core/src/config.rs
+++ b/crates/trusted-server-core/src/config.rs
@@ -23,7 +23,7 @@ use crate::integrations::{
     google_tag_manager::GoogleTagManagerConfig,
     gpt::GptConfig,
     gpt_diagnostics::{GPT_DIAGNOSTICS_INTEGRATION_ID, GptDiagnosticsConfig},
-    js_asset_proxy::{JS_ASSET_PROXY_INTEGRATION_ID, JsAssetProxyConfig},
+    js_asset_proxy::{JS_ASSET_PROXY_INTEGRATION_ID, JsAssetProxyConfig, JsAssetProxyMode},
     lockr::LockrConfig,
     nextjs::NextJsIntegrationConfig,
     osano::OsanoConfig,
@@ -330,7 +330,39 @@ fn validate_js_asset_proxy_config(settings: &Settings) -> Result<(), Report<Trus
                 "integration startup failed for `{JS_ASSET_PROXY_INTEGRATION_ID}`: {error}"
             ),
         })
-    })
+    })?;
+    validate_js_asset_proxy_prebid_overlap(settings, &config)
+}
+
+/// Rejects `enabled` JS assets that Prebid's script interception would remove.
+///
+/// Prebid removes publisher Prebid.js tags to keep a single Prebid instance next
+/// to the managed bundle. An `enabled` asset for such a URL is either a dead
+/// entry or loads a second Prebid.js copy, so it is contradictory config.
+fn validate_js_asset_proxy_prebid_overlap(
+    settings: &Settings,
+    config: &JsAssetProxyConfig,
+) -> Result<(), Report<TrustedServerError>> {
+    if !config.enabled {
+        return Ok(());
+    }
+    let Some(prebid_config) =
+        settings.integration_config::<prebid::PrebidIntegrationConfig>("prebid")?
+    else {
+        return Ok(());
+    };
+    let Some(asset) = config.assets.iter().find(|asset| {
+        asset.proxy == JsAssetProxyMode::Enabled
+            && prebid_config.matches_script_url(&asset.origin_url)
+    }) else {
+        return Ok(());
+    };
+    Err(Report::new(TrustedServerError::Configuration {
+        message: format!(
+            "integration startup failed for `{JS_ASSET_PROXY_INTEGRATION_ID}`: asset `{}` with origin_url `{}` has proxy = \"enabled\" in [[integrations.js_asset_proxy.assets]], but [integrations.prebid] script_patterns intercept that URL to prevent duplicate Prebid instances; set proxy = \"disabled\" to keep Prebid's interception, set proxy = \"blocked\" to remove the script, or remove the matching pattern from [integrations.prebid] script_patterns (not recommended; may duplicate the managed bundle)",
+            asset.path, asset.origin_url
+        ),
+    }))
 }
 
 fn validate_enabled_integrations(
@@ -1589,6 +1621,72 @@ password = "production-admin-password-32-bytes"
         );
     }
 
+    fn settings_with_prebid_script_asset(mode: &str) -> Settings {
+        // `valid_settings` enables `[integrations.prebid]` with the default
+        // `script_patterns`, which match `/prebid.min.js`.
+        let mut settings = valid_settings();
+        settings
+            .integrations
+            .insert_config(
+                JS_ASSET_PROXY_INTEGRATION_ID,
+                &serde_json::json!({
+                    "enabled": true,
+                    "assets": [{
+                        "path": "/assets/vendor-pb.js",
+                        "origin_url": "https://cdn.example.com/prebid.min.js",
+                        "proxy": mode
+                    }]
+                }),
+            )
+            .expect("should insert JS asset proxy config");
+        settings
+    }
+
+    #[test]
+    fn validation_rejects_enabled_js_asset_intercepted_by_prebid() {
+        let settings = settings_with_prebid_script_asset("enabled");
+
+        for result in [
+            validate_settings_for_deploy(&settings),
+            validate_settings_for_runtime(&settings),
+        ] {
+            let message = result
+                .expect_err("should reject enabled asset intercepted by Prebid")
+                .to_string();
+            assert!(
+                message.contains("[[integrations.js_asset_proxy.assets]]")
+                    && message.contains("[integrations.prebid]"),
+                "error should name both tables: {message}"
+            );
+            assert!(
+                message.contains("/assets/vendor-pb.js"),
+                "error should name the conflicting asset: {message}"
+            );
+        }
+    }
+
+    #[test]
+    fn validation_accepts_disabled_and_blocked_js_assets_intercepted_by_prebid() {
+        for mode in ["disabled", "blocked"] {
+            let settings = settings_with_prebid_script_asset(mode);
+
+            validate_settings_for_deploy(&settings)
+                .expect("should accept non-enabled asset intercepted by Prebid");
+        }
+    }
+
+    #[test]
+    fn validation_accepts_enabled_prebid_script_asset_when_prebid_disabled() {
+        let mut settings = settings_with_prebid_script_asset("enabled");
+        settings
+            .integrations
+            .insert_config("prebid", &serde_json::json!({ "enabled": false }))
+            .expect("should insert disabled prebid config");
+
+        validate_settings_for_deploy(&settings)
+            .expect("should accept enabled asset when Prebid interception is off");
+    }
+
     #[test]
     fn deploy_validation_requires_external_bundle_url_for_enabled_prebid() {
         let mut settings = valid_settings();
diff --git a/crates/trusted-server-core/src/integrations/js_asset_proxy.rs b/crates/trusted-server-core/src/integrations/js_asset_proxy.rs
index bb1a875e8f..5c8e341b36 100644
--- a/crates/trusted-server-core/src/integrations/js_asset_proxy.rs
+++ b/crates/trusted-server-core/src/integrations/js_asset_proxy.rs
@@ -656,6 +656,60 @@ mod tests {
         String::from_utf8(output).expect("should produce UTF-8 HTML")
     }
 
+    fn process_prebid_script_with_asset_mode(mode: &str) -> String {
+        // `create_test_settings` enables `[integrations.prebid]` with the default
+        // `script_patterns`, so its attribute rewriter matches `/prebid.min.js`.
+        let mut settings = create_test_settings();
+        settings
+            .integrations
+            .insert_config(
+                JS_ASSET_PROXY_INTEGRATION_ID,
+                &json!({
+                    "enabled": true,
+                    "assets": [{
+                        "path": "/assets/vendor-pb.js",
+                        "origin_url": "https://cdn.example.com/prebid.min.js",
+                        "proxy": mode
+                    }]
+                }),
+            )
+            .expect("should insert JS asset proxy config");
+        let registry = IntegrationRegistry::new(&settings).expect("should build registry");
+        let html = r#"<html><body><script src="https://cdn.example.com/prebid.min.js"></script></body></html>"#;
+
+        process_html_with_registry(html, registry)
+    }
+
+    #[test]
+    fn js_asset_proxy_rewriter_takes_precedence_over_prebid_script_removal() {
+        let processed = process_prebid_script_with_asset_mode("enabled");
+
+        assert!(
+            processed.contains(r#"<script src="/assets/vendor-pb.js"></script>"#),
+            "JS asset proxy should rewrite before Prebid removes the script: {processed}"
+        );
+    }
+
+    #[test]
+    fn blocked_js_asset_proxy_entry_removes_prebid_script() {
+        let processed = process_prebid_script_with_asset_mode("blocked");
+
+        assert!(
+            !processed.contains("prebid.min.js") && !processed.contains("<script"),
+            "blocked JS asset should remove the script element: {processed}"
+        );
+    }
+
+    #[test]
+    fn disabled_js_asset_proxy_entry_lets_prebid_remove_script() {
+        let processed = process_prebid_script_with_asset_mode("disabled");
+
+        assert!(
+            !processed.contains("prebid.min.js") && !processed.contains("<script"),
+            "disabled JS asset should defer to Prebid script interception: {processed}"
+        );
+    }
+
     #[test]
     fn disabled_config_does_not_register_routes() {
         let mut settings = create_test_settings();
diff --git a/crates/trusted-server-core/src/integrations/mod.rs b/crates/trusted-server-core/src/integrations/mod.rs
index 9e3840b3fb..197ef9880f 100644
--- a/crates/trusted-server-core/src/integrations/mod.rs
+++ b/crates/trusted-server-core/src/integrations/mod.rs
@@ -290,7 +290,10 @@ pub(crate) struct IntegrationBuilder {
 
 pub(crate) fn builders() -> &'static [IntegrationBuilder] {
     &[
-        // This must remain first: attribute rewriters chain replacements and short-circuit removals.
+        // Attribute rewriters chain replacements and short-circuit removals, so
+        // `js_asset_proxy` must run first. `IntegrationRegistry::with_plan` enforces
+        // this by sorting its attribute rewriter ahead of every other one; list
+        // position here does not decide precedence.
         IntegrationBuilder {
             id: js_asset_proxy::JS_ASSET_PROXY_INTEGRATION_ID,
             build: js_asset_proxy::register,
diff --git a/crates/trusted-server-core/src/integrations/prebid.rs b/crates/trusted-server-core/src/integrations/prebid.rs
index c13260704f..4149f0f525 100644
--- a/crates/trusted-server-core/src/integrations/prebid.rs
+++ b/crates/trusted-server-core/src/integrations/prebid.rs
@@ -586,6 +586,79 @@ impl Default for PrebidIntegrationConfig {
     }
 }
 
+impl PrebidIntegrationConfig {
+    /// Reports whether Prebid's script interception removes a `<script src>` URL.
+    ///
+    /// The query and fragment are ignored, and the URL path is matched against
+    /// [`Self::script_patterns`] case-insensitively.
+    pub(crate) fn matches_script_url(&self, attr_value: &str) -> bool {
+        let trimmed = attr_value.trim();
+        let without_query = trimmed.split(['?', '#']).next().unwrap_or(trimmed);
+
+        if self.matches_script_pattern(without_query) {
+            return true;
+        }
+
+        if !without_query.starts_with('/')
+            && !without_query.starts_with("//")
+            && !without_query.contains("://")
+        {
+            let with_slash = format!("/{without_query}");
+            if self.matches_script_pattern(&with_slash) {
+                return true;
+            }
+        }
+
+        let parsed = if without_query.starts_with("//") {
+            ParsedUrl::parse(&format!("https:{without_query}"))
+        } else {
+            ParsedUrl::parse(without_query)
+        };
+
+        parsed
+            .ok()
+            .is_some_and(|url| self.matches_script_pattern(url.path()))
+    }
+
+    /// Reports whether a request path matches one of [`Self::script_patterns`].
+    fn matches_script_pattern(&self, path: &str) -> bool {
+        // Normalize path to lowercase for case-insensitive matching
+        let path_lower = path.to_ascii_lowercase();
+
+        // Check if path matches any configured pattern
+        for pattern in &self.script_patterns {
+            let pattern_lower = pattern.to_ascii_lowercase();
+
+            // Check for wildcard patterns: /* or {*name}
+            if pattern_lower.ends_with("/*") || pattern_lower.contains("{*") {
+                // Extract prefix before the wildcard
+                let prefix = if pattern_lower.ends_with("/*") {
+                    &pattern_lower[..pattern_lower.len() - 1] // Remove trailing *
+                } else {
+                    // Find {* and extract prefix before it
+                    pattern_lower.split("{*").next().unwrap_or("")
+                };
+
+                if path_lower.starts_with(prefix) {
+                    // Check if it ends with a known Prebid script suffix
+                    if PREBID_SCRIPT_SUFFIXES
+                        .iter()
+                        .any(|suffix| path_lower.ends_with(suffix))
+                    {
+                        return true;
+                    }
+                }
+            } else {
+                // Exact match or suffix match
+                if path_lower.ends_with(&pattern_lower) {
+                    return true;
+                }
+            }
+        }
+        false
+    }
+}
+
 impl IntegrationConfig for PrebidIntegrationConfig {
     fn is_enabled(&self) -> bool {
         self.enabled
@@ -1024,69 +1097,11 @@ impl PrebidIntegration {
     }
 
     fn matches_script_url(&self, attr_value: &str) -> bool {
-        let trimmed = attr_value.trim();
-        let without_query = trimmed.split(['?', '#']).next().unwrap_or(trimmed);
-
-        if self.matches_script_pattern(without_query) {
-            return true;
-        }
-
-        if !without_query.starts_with('/')
-            && !without_query.starts_with("//")
-            && !without_query.contains("://")
-        {
-            let with_slash = format!("/{without_query}");
-            if self.matches_script_pattern(&with_slash) {
-                return true;
-            }
-        }
-
-        let parsed = if without_query.starts_with("//") {
-            ParsedUrl::parse(&format!("https:{without_query}"))
-        } else {
-            ParsedUrl::parse(without_query)
-        };
-
-        parsed
-            .ok()
-            .is_some_and(|url| self.matches_script_pattern(url.path()))
+        self.config.matches_script_url(attr_value)
     }
 
     fn matches_script_pattern(&self, path: &str) -> bool {
-        // Normalize path to lowercase for case-insensitive matching
-        let path_lower = path.to_ascii_lowercase();
-
-        // Check if path matches any configured pattern
-        for pattern in &self.config.script_patterns {
-            let pattern_lower = pattern.to_ascii_lowercase();
-
-            // Check for wildcard patterns: /* or {*name}
-            if pattern_lower.ends_with("/*") || pattern_lower.contains("{*") {
-                // Extract prefix before the wildcard
-                let prefix = if pattern_lower.ends_with("/*") {
-                    &pattern_lower[..pattern_lower.len() - 1] // Remove trailing *
-                } else {
-                    // Find {* and extract prefix before it
-                    pattern_lower.split("{*").next().unwrap_or("")
-                };
-
-                if path_lower.starts_with(prefix) {
-                    // Check if it ends with a known Prebid script suffix
-                    if PREBID_SCRIPT_SUFFIXES
-                        .iter()
-                        .any(|suffix| path_lower.ends_with(suffix))
-                    {
-                        return true;
-                    }
-                }
-            } else {
-                // Exact match or suffix match
-                if path_lower.ends_with(&pattern_lower) {
-                    return true;
-                }
-            }
-        }
-        false
+        self.config.matches_script_pattern(path)
     }
 
     fn handle_script_handler(
diff --git a/crates/trusted-server-core/src/integrations/registry.rs b/crates/trusted-server-core/src/integrations/registry.rs
index 15a6486fd8..0b78ff7830 100644
--- a/crates/trusted-server-core/src/integrations/registry.rs
+++ b/crates/trusted-server-core/src/integrations/registry.rs
@@ -921,6 +921,15 @@ impl IntegrationRegistry {
             }
         }
 
+        // `js_asset_proxy` is the operator's per-URL override, so it runs before
+        // every native attribute rewriter regardless of registration order:
+        // `rewrite_attribute` chains replacements and short-circuits removals.
+        // The sort is stable, so the other rewriters keep registration order.
+        inner.html_rewriters.sort_by_key(|rewriter| {
+            rewriter.integration_id()
+                != crate::integrations::js_asset_proxy::JS_ASSET_PROXY_INTEGRATION_ID
+        });
+
         let registry = Self {
             inner: Arc::new(inner),
             plan: Some(plan),
@@ -1246,6 +1255,16 @@ impl IntegrationRegistry {
         map.into_values().collect()
     }
 
+    /// Return attribute rewriter integration IDs in execution order.
+    #[cfg(test)]
+    pub(crate) fn attribute_rewriter_ids(&self) -> Vec<&'static str> {
+        self.inner
+            .html_rewriters
+            .iter()
+            .map(|rewriter| rewriter.integration_id())
+            .collect()
+    }
+
     /// Return whether an integration is enabled in this registry.
     #[must_use]
     pub fn integration_enabled(&self, integration_id: &str) -> bool {

From c1daf4d7199e2d50ba4339502c0535c9df3ca806 Mon Sep 17 00:00:00 2001
From: dhruv8sh <dhruv8sh@proton.me>
Date: Tue, 10 Nov 2026 18:56:18 +0530
Subject: [PATCH 2/5] Make js_asset_proxy attribute replacements terminal

An enabled js_asset_proxy replacement now returns from rewrite_attribute without passing through later rewriters, so Prebid no longer removes a proxied script whose first-party path matches its script_patterns. Add a regression test for that mapping and note that settings validation rejects the precedence fixture.

Signed-off-by: dhruv8sh <dhruv8sh@proton.me>
---
 .../src/integrations/js_asset_proxy.rs        | 36 ++++++++++++++++---
 .../src/integrations/mod.rs                   |  8 ++---
 .../src/integrations/registry.rs              | 17 +++++++--
 3 files changed, 49 insertions(+), 12 deletions(-)

diff --git a/crates/trusted-server-core/src/integrations/js_asset_proxy.rs b/crates/trusted-server-core/src/integrations/js_asset_proxy.rs
index 5c8e341b36..66401f21ea 100644
--- a/crates/trusted-server-core/src/integrations/js_asset_proxy.rs
+++ b/crates/trusted-server-core/src/integrations/js_asset_proxy.rs
@@ -656,7 +656,7 @@ mod tests {
         String::from_utf8(output).expect("should produce UTF-8 HTML")
     }
 
-    fn process_prebid_script_with_asset_mode(mode: &str) -> String {
+    fn process_script_with_asset(path: &str, origin_url: &str, mode: &str) -> String {
         // `create_test_settings` enables `[integrations.prebid]` with the default
         // `script_patterns`, so its attribute rewriter matches `/prebid.min.js`.
         let mut settings = create_test_settings();
@@ -667,21 +667,31 @@ mod tests {
                 &json!({
                     "enabled": true,
                     "assets": [{
-                        "path": "/assets/vendor-pb.js",
-                        "origin_url": "https://cdn.example.com/prebid.min.js",
+                        "path": path,
+                        "origin_url": origin_url,
                         "proxy": mode
                     }]
                 }),
             )
             .expect("should insert JS asset proxy config");
         let registry = IntegrationRegistry::new(&settings).expect("should build registry");
-        let html = r#"<html><body><script src="https://cdn.example.com/prebid.min.js"></script></body></html>"#;
+        let html = format!(r#"<html><body><script src="{origin_url}"></script></body></html>"#);
 
-        process_html_with_registry(html, registry)
+        process_html_with_registry(&html, registry)
+    }
+
+    fn process_prebid_script_with_asset_mode(mode: &str) -> String {
+        process_script_with_asset(
+            "/assets/vendor-pb.js",
+            "https://cdn.example.com/prebid.min.js",
+            mode,
+        )
     }
 
     #[test]
     fn js_asset_proxy_rewriter_takes_precedence_over_prebid_script_removal() {
+        // Settings validation rejects this asset because it would load a second
+        // Prebid.js; the registry does not validate, so this pins rewriter order.
         let processed = process_prebid_script_with_asset_mode("enabled");
 
         assert!(
@@ -690,6 +700,22 @@ mod tests {
         );
     }
 
+    #[test]
+    fn enabled_js_asset_proxy_replacement_is_not_rewritten_by_prebid() {
+        // The proxied `path` matches Prebid `script_patterns`; the replacement
+        // must be terminal so Prebid does not remove the rewritten script.
+        let processed = process_script_with_asset(
+            "/assets/prebid.min.js",
+            "https://cdn.example.com/vendor.js",
+            "enabled",
+        );
+
+        assert!(
+            processed.contains(r#"<script src="/assets/prebid.min.js"></script>"#),
+            "JS asset proxy replacement should be terminal: {processed}"
+        );
+    }
+
     #[test]
     fn blocked_js_asset_proxy_entry_removes_prebid_script() {
         let processed = process_prebid_script_with_asset_mode("blocked");
diff --git a/crates/trusted-server-core/src/integrations/mod.rs b/crates/trusted-server-core/src/integrations/mod.rs
index 197ef9880f..4588c8f223 100644
--- a/crates/trusted-server-core/src/integrations/mod.rs
+++ b/crates/trusted-server-core/src/integrations/mod.rs
@@ -290,10 +290,10 @@ pub(crate) struct IntegrationBuilder {
 
 pub(crate) fn builders() -> &'static [IntegrationBuilder] {
     &[
-        // Attribute rewriters chain replacements and short-circuit removals, so
-        // `js_asset_proxy` must run first. `IntegrationRegistry::with_plan` enforces
-        // this by sorting its attribute rewriter ahead of every other one; list
-        // position here does not decide precedence.
+        // `js_asset_proxy` must decide first, and its replacements are terminal.
+        // `IntegrationRegistry::with_plan` enforces this by sorting its attribute
+        // rewriter ahead of every other one; list position here does not decide
+        // precedence.
         IntegrationBuilder {
             id: js_asset_proxy::JS_ASSET_PROXY_INTEGRATION_ID,
             build: js_asset_proxy::register,
diff --git a/crates/trusted-server-core/src/integrations/registry.rs b/crates/trusted-server-core/src/integrations/registry.rs
index 0b78ff7830..3a282afa33 100644
--- a/crates/trusted-server-core/src/integrations/registry.rs
+++ b/crates/trusted-server-core/src/integrations/registry.rs
@@ -922,9 +922,10 @@ impl IntegrationRegistry {
         }
 
         // `js_asset_proxy` is the operator's per-URL override, so it runs before
-        // every native attribute rewriter regardless of registration order:
-        // `rewrite_attribute` chains replacements and short-circuits removals.
-        // The sort is stable, so the other rewriters keep registration order.
+        // every native attribute rewriter regardless of registration order, and
+        // `rewrite_attribute` treats its replacement as terminal. Other
+        // replacements chain and removals short-circuit. The sort is stable, so
+        // the other rewriters keep registration order.
         inner.html_rewriters.sort_by_key(|rewriter| {
             rewriter.integration_id()
                 != crate::integrations::js_asset_proxy::JS_ASSET_PROXY_INTEGRATION_ID
@@ -1066,6 +1067,9 @@ impl IntegrationRegistry {
     }
 
     /// Give integrations a chance to rewrite HTML attributes.
+    ///
+    /// Replacements chain through later rewriters, except a `js_asset_proxy`
+    /// replacement, which is returned as is. A removal ends the chain.
     #[must_use]
     pub fn rewrite_attribute(
         &self,
@@ -1082,6 +1086,13 @@ impl IntegrationRegistry {
             match rewriter.rewrite(attr_name, &current, ctx) {
                 AttributeRewriteAction::Keep => {}
                 AttributeRewriteAction::Replace(next_value) => {
+                    // A `js_asset_proxy` replacement is the operator's explicit
+                    // per-URL decision, so no later rewriter sees or changes it.
+                    if rewriter.integration_id()
+                        == crate::integrations::js_asset_proxy::JS_ASSET_PROXY_INTEGRATION_ID
+                    {
+                        return AttributeRewriteOutcome::Replaced(next_value);
+                    }
                     current = next_value;
                     changed = true;
                 }

From 49992fad65deb11c005a37929bb1664342c968f8 Mon Sep 17 00:00:00 2001
From: dhruv8sh <dhruv8sh@proton.me>
Date: Tue, 10 Nov 2026 18:56:18 +0530
Subject: [PATCH 3/5] Report every js_asset_proxy asset that Prebid intercepts

Collect all conflicting enabled assets into one validation error, pin the disabled-integration guard with a test, widen the matches_script_url doc to src and href, and share the APS provider fixture in plan_sharing_tests.

Signed-off-by: dhruv8sh <dhruv8sh@proton.me>
---
 crates/trusted-server-core/src/auction/mod.rs | 41 ++++-----
 crates/trusted-server-core/src/config.rs      | 83 +++++++++++++++++--
 .../src/integrations/prebid.rs                |  2 +-
 3 files changed, 92 insertions(+), 34 deletions(-)

diff --git a/crates/trusted-server-core/src/auction/mod.rs b/crates/trusted-server-core/src/auction/mod.rs
index 853bb9e894..3c0927dc89 100644
--- a/crates/trusted-server-core/src/auction/mod.rs
+++ b/crates/trusted-server-core/src/auction/mod.rs
@@ -130,6 +130,21 @@ mod plan_sharing_tests {
     use crate::integrations::IntegrationRegistry;
     use crate::test_support::tests::create_test_settings;
 
+    fn aps_provider_map() -> std::collections::BTreeMap<ProviderId, ProviderConfig> {
+        std::collections::BTreeMap::from([(
+            "aps-main".parse().expect("should parse APS provider ID"),
+            ProviderConfig {
+                protocol: "openrtb-2.6".to_string(),
+                profile: "aps".to_string(),
+                endpoint: "https://aps.example/e/pb/bid".to_string(),
+                timeout_ms: None,
+                routing: RoutingMode::AllEligible,
+                notifications: NotificationConfig::default(),
+                profile_config: serde_json::json!({"account_id":"example-account"}),
+            },
+        )])
+    }
+
     #[test]
     fn orchestrator_and_registry_share_the_compiled_plan_allocation() {
         let settings = create_test_settings();
@@ -212,18 +227,7 @@ mod plan_sharing_tests {
     #[test]
     fn aps_profile_registers_renderer_without_browser_aps_config() {
         let mut settings = create_test_settings();
-        settings.auction.providers = std::collections::BTreeMap::from([(
-            "aps-main".parse().expect("should parse APS provider ID"),
-            ProviderConfig {
-                protocol: "openrtb-2.6".to_string(),
-                profile: "aps".to_string(),
-                endpoint: "https://aps.example/e/pb/bid".to_string(),
-                timeout_ms: None,
-                routing: RoutingMode::AllEligible,
-                notifications: NotificationConfig::default(),
-                profile_config: serde_json::json!({"account_id":"example-account"}),
-            },
-        )]);
+        settings.auction.providers = aps_provider_map();
         let plan = Arc::new(compile_auction_plan(&settings).expect("should compile APS plan"));
         let registry = IntegrationRegistry::with_plan(&settings, plan)
             .expect("should build APS renderer registry");
@@ -236,18 +240,7 @@ mod plan_sharing_tests {
         // `create_test_settings` enables Prebid; add an APS profile, GPT and
         // `js_asset_proxy` so plan registrations precede the builder table.
         let mut settings = create_test_settings();
-        settings.auction.providers = std::collections::BTreeMap::from([(
-            "aps-main".parse().expect("should parse APS provider ID"),
-            ProviderConfig {
-                protocol: "openrtb-2.6".to_string(),
-                profile: "aps".to_string(),
-                endpoint: "https://aps.example/e/pb/bid".to_string(),
-                timeout_ms: None,
-                routing: RoutingMode::AllEligible,
-                notifications: NotificationConfig::default(),
-                profile_config: serde_json::json!({"account_id":"example-account"}),
-            },
-        )]);
+        settings.auction.providers = aps_provider_map();
         settings
             .integrations
             .insert_config("gpt", &serde_json::json!({ "enabled": true }))
diff --git a/crates/trusted-server-core/src/config.rs b/crates/trusted-server-core/src/config.rs
index d084de4212..d7373ffc53 100644
--- a/crates/trusted-server-core/src/config.rs
+++ b/crates/trusted-server-core/src/config.rs
@@ -337,8 +337,9 @@ fn validate_js_asset_proxy_config(settings: &Settings) -> Result<(), Report<Trus
 /// Rejects `enabled` JS assets that Prebid's script interception would remove.
 ///
 /// Prebid removes publisher Prebid.js tags to keep a single Prebid instance next
-/// to the managed bundle. An `enabled` asset for such a URL is either a dead
-/// entry or loads a second Prebid.js copy, so it is contradictory config.
+/// to the managed bundle. JS Asset Proxy decides first and its replacement is
+/// terminal, so an `enabled` asset for such a URL would load a second Prebid.js
+/// copy. Every conflicting asset is reported in one error.
 fn validate_js_asset_proxy_prebid_overlap(
     settings: &Settings,
     config: &JsAssetProxyConfig,
@@ -351,16 +352,22 @@ fn validate_js_asset_proxy_prebid_overlap(
     else {
         return Ok(());
     };
-    let Some(asset) = config.assets.iter().find(|asset| {
-        asset.proxy == JsAssetProxyMode::Enabled
-            && prebid_config.matches_script_url(&asset.origin_url)
-    }) else {
+    let conflicts: Vec<String> = config
+        .assets
+        .iter()
+        .filter(|asset| {
+            asset.proxy == JsAssetProxyMode::Enabled
+                && prebid_config.matches_script_url(&asset.origin_url)
+        })
+        .map(|asset| format!("`{}` (origin_url `{}`)", asset.path, asset.origin_url))
+        .collect();
+    if conflicts.is_empty() {
         return Ok(());
-    };
+    }
     Err(Report::new(TrustedServerError::Configuration {
         message: format!(
-            "integration startup failed for `{JS_ASSET_PROXY_INTEGRATION_ID}`: asset `{}` with origin_url `{}` has proxy = \"enabled\" in [[integrations.js_asset_proxy.assets]], but [integrations.prebid] script_patterns intercept that URL to prevent duplicate Prebid instances; set proxy = \"disabled\" to keep Prebid's interception, set proxy = \"blocked\" to remove the script, or remove the matching pattern from [integrations.prebid] script_patterns (not recommended; may duplicate the managed bundle)",
-            asset.path, asset.origin_url
+            "integration startup failed for `{JS_ASSET_PROXY_INTEGRATION_ID}`: assets {} have proxy = \"enabled\" in [[integrations.js_asset_proxy.assets]], but [integrations.prebid] script_patterns intercept those URLs to prevent duplicate Prebid instances; set proxy = \"disabled\" to keep Prebid's interception, set proxy = \"blocked\" to remove the script, or remove the matching pattern from [integrations.prebid] script_patterns (not recommended; may duplicate the managed bundle)",
+            conflicts.join(", ")
         ),
     }))
 }
@@ -1687,6 +1694,64 @@ password = "production-admin-password-32-bytes"
             .expect("should accept enabled asset when Prebid interception is off");
     }
 
+    #[test]
+    fn validation_accepts_enabled_prebid_script_asset_when_js_asset_proxy_disabled() {
+        let mut settings = valid_settings();
+        settings
+            .integrations
+            .insert_config(
+                JS_ASSET_PROXY_INTEGRATION_ID,
+                &serde_json::json!({
+                    "enabled": false,
+                    "assets": [{
+                        "path": "/assets/vendor-pb.js",
+                        "origin_url": "https://cdn.example.com/prebid.min.js",
+                        "proxy": "enabled"
+                    }]
+                }),
+            )
+            .expect("should insert disabled JS asset proxy config");
+
+        validate_settings_for_deploy(&settings)
+            .expect("should accept a staged enabled asset while JS asset proxy is disabled");
+    }
+
+    #[test]
+    fn validation_reports_every_enabled_js_asset_intercepted_by_prebid() {
+        let mut settings = valid_settings();
+        settings
+            .integrations
+            .insert_config(
+                JS_ASSET_PROXY_INTEGRATION_ID,
+                &serde_json::json!({
+                    "enabled": true,
+                    "assets": [
+                        {
+                            "path": "/assets/vendor-pb.js",
+                            "origin_url": "https://cdn.example.com/prebid.js",
+                            "proxy": "enabled"
+                        },
+                        {
+                            "path": "/assets/vendor-pb-min.js",
+                            "origin_url": "https://cdn.example.com/prebid.min.js",
+                            "proxy": "enabled"
+                        }
+                    ]
+                }),
+            )
+            .expect("should insert JS asset proxy config");
+
+        let message = validate_settings_for_deploy(&settings)
+            .expect_err("should reject enabled assets intercepted by Prebid")
+            .to_string();
+
+        assert!(
+            message.contains("/assets/vendor-pb.js")
+                && message.contains("/assets/vendor-pb-min.js"),
+            "error should name every conflicting asset: {message}"
+        );
+    }
+
     #[test]
     fn deploy_validation_requires_external_bundle_url_for_enabled_prebid() {
         let mut settings = valid_settings();
diff --git a/crates/trusted-server-core/src/integrations/prebid.rs b/crates/trusted-server-core/src/integrations/prebid.rs
index 4149f0f525..c3fb73aa2d 100644
--- a/crates/trusted-server-core/src/integrations/prebid.rs
+++ b/crates/trusted-server-core/src/integrations/prebid.rs
@@ -587,7 +587,7 @@ impl Default for PrebidIntegrationConfig {
 }
 
 impl PrebidIntegrationConfig {
-    /// Reports whether Prebid's script interception removes a `<script src>` URL.
+    /// Reports whether Prebid's interception removes an element with this `src` or `href` value.
     ///
     /// The query and fragment are ignored, and the URL path is matched against
     /// [`Self::script_patterns`] case-insensitively.

From fdc831f1c7be6d834379dfc925540981a8f02368 Mon Sep 17 00:00:00 2001
From: dhruv8sh <dhruv8sh@proton.me>
Date: Tue, 10 Nov 2026 18:56:18 +0530
Subject: [PATCH 4/5] Document js_asset_proxy precedence and the Prebid overlap
 rule

Add a Breaking CHANGELOG entry for the new startup rejection and describe the rule in the configuration, CLI and Prebid guides.

Signed-off-by: dhruv8sh <dhruv8sh@proton.me>
---
 CHANGELOG.md                      |  9 +++++++++
 docs/guide/cli.md                 |  4 ++++
 docs/guide/configuration.md       | 11 +++++++++++
 docs/guide/integrations/prebid.md |  4 ++++
 4 files changed, 28 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4d5d0b9ea8..94a750b4bc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- **Breaking:** With `[integrations.prebid]` enabled, JS asset entries with
+  `proxy = "enabled"` whose `origin_url` matches Prebid `script_patterns`
+  now fail deploy validation and runtime startup. Before upgrading the
+  server, use the new `ts` CLI to run `ts config validate`, change overlapping
+  assets to `proxy = "disabled"` (preserves Prebid interception) or
+  `proxy = "blocked"`, and publish the corrected config with `ts config push`.
+  JS Asset Proxy now rewrites script tags before every other integration, and
+  its `enabled` replacement is final: no later integration rewrites or removes
+  the proxied tag.
 - The Lockr browser module no longer polls for private SDK state or mutates its API host, removing the "Lockr SDK not detected" timeout warning (#1247). Root-relative Lockr XHR API requests and rewritten SDK URLs now stay on the page origin even with an external `<base href>`. Custom or unreplaced legacy SDKs that relied on the removed host rewrite must route their own API calls through `/integrations/lockr/api`; `rewrite_sdk = false` leaves static SDK tags unchanged but does not disable dynamic interception. See the [Lockr migration guide](docs/guide/integrations/lockr.md#migration-from-the-sdk-host-shim).
 - Auction response collection now bounds network waiting by `[auction].timeout_ms`
   measured from dispatch, including delayed headers and trickling bodies on all
diff --git a/docs/guide/cli.md b/docs/guide/cli.md
index 70227ca493..1730e8987f 100644
--- a/docs/guide/cli.md
+++ b/docs/guide/cli.md
@@ -342,6 +342,10 @@ register routes or rewrite HTML until you set
 runtime-injected scripts; JS Asset Proxy only rewrites matching script `src` URLs
 present in HTML processed by Trusted Server.
 
+While `[integrations.prebid]` is enabled, an entry whose URL matches Prebid
+`script_patterns` cannot be `"enabled"`; keep it `"disabled"` so Prebid
+intercepts the script, or set it to `"blocked"`.
+
 If a config already exists, avoid overwriting it:
 
 ```bash
diff --git a/docs/guide/configuration.md b/docs/guide/configuration.md
index 8413e77d09..eab65bdbc4 100644
--- a/docs/guide/configuration.md
+++ b/docs/guide/configuration.md
@@ -1877,6 +1877,17 @@ Each `[[integrations.js_asset_proxy.assets]]` entry:
 | `proxy`             | String  | `enabled` | `enabled`, `disabled`, or `blocked` (removes script tags) |
 | `cache_ttl_seconds` | Integer | None      | Optional per-asset downstream cache TTL override          |
 
+JS Asset Proxy decides first for each script whose `src` matches an asset's
+`origin_url`, before other integrations rewrite the tag: `enabled` serves it
+from `path`, `blocked` removes the script, and `disabled` leaves it to other
+integrations.
+
+While `[integrations.prebid]` is enabled, an `enabled` asset whose `origin_url`
+matches Prebid `script_patterns` fails `ts config validate` and server startup,
+because it would load a second Prebid.js next to the managed bundle. Use
+`proxy = "disabled"` to let Prebid intercept the script, or `proxy = "blocked"`
+to remove it.
+
 ### lockr Integration
 
 **Section**: `[integrations.lockr]`
diff --git a/docs/guide/integrations/prebid.md b/docs/guide/integrations/prebid.md
index b7a05ac7be..e26d487dc4 100644
--- a/docs/guide/integrations/prebid.md
+++ b/docs/guide/integrations/prebid.md
@@ -467,6 +467,10 @@ Optional Ed25519 request signing for bid request authentication and fraud preven
 
 The `script_patterns` configuration controls which publisher-provided Prebid scripts are intercepted and replaced with empty JavaScript. Trusted Server always injects its managed first-party `/integrations/prebid/bundle.js` script for the configured external bundle, so interception prevents duplicate Prebid instances.
 
+A `[[integrations.js_asset_proxy.assets]]` entry for an intercepted URL must use
+`proxy = "disabled"` (Prebid intercepts it) or `proxy = "blocked"`; `enabled`
+fails validation.
+
 **Pattern Matching**:
 
 - **Suffix matching**: `/prebid.min.js` matches any URL ending with that path

From ca49b924df65545283c97a0a2b61b53786601fd0 Mon Sep 17 00:00:00 2001
From: dhruv8sh <dhruv8sh@proton.me>
Date: Thu, 12 Nov 2026 00:44:26 +0530
Subject: [PATCH 5/5] Test that JS asset proxy replacements are terminal while
 others chain

Pin both halves of the rewrite_attribute contract: a later rewriter never sees the proxied replacement, and replacements from other integrations keep chaining.

Signed-off-by: dhruv8sh <dhruv8sh@proton.me>
---
 .../src/integrations/js_asset_proxy.rs        | 58 +++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/crates/trusted-server-core/src/integrations/js_asset_proxy.rs b/crates/trusted-server-core/src/integrations/js_asset_proxy.rs
index 3b7e922e05..7e8c2e90e9 100644
--- a/crates/trusted-server-core/src/integrations/js_asset_proxy.rs
+++ b/crates/trusted-server-core/src/integrations/js_asset_proxy.rs
@@ -717,6 +717,64 @@ mod tests {
         );
     }
 
+    /// Appends `?chained` so a test can see whether a replacement reached it.
+    struct AppendChainedRewriter;
+
+    impl IntegrationAttributeRewriter for AppendChainedRewriter {
+        fn integration_id(&self) -> &'static str {
+            "append_chained"
+        }
+
+        fn handles_attribute(&self, attribute: &str) -> bool {
+            attribute == "src"
+        }
+
+        fn rewrite(
+            &self,
+            _attr_name: &str,
+            attr_value: &str,
+            _ctx: &IntegrationAttributeContext<'_>,
+        ) -> AttributeRewriteAction {
+            AttributeRewriteAction::replace(format!("{attr_value}?chained"))
+        }
+    }
+
+    #[test]
+    fn js_asset_proxy_replacement_is_terminal_while_other_replacements_chain() {
+        let proxy: Arc<dyn IntegrationAttributeRewriter> =
+            JsAssetProxyIntegration::new(config_with_assets(vec![asset(
+                "/assets/vendor.js",
+                "https://cdn.example.com/vendor.js",
+                JsAssetProxyMode::Enabled,
+            )]));
+        let chained: Arc<dyn IntegrationAttributeRewriter> = Arc::new(AppendChainedRewriter);
+        let registry = IntegrationRegistry::from_rewriters(
+            vec![proxy, Arc::clone(&chained), chained],
+            Vec::new(),
+        );
+
+        assert_eq!(
+            registry.rewrite_attribute(
+                "src",
+                "https://cdn.example.com/vendor.js",
+                &rewrite_context()
+            ),
+            crate::integrations::AttributeRewriteOutcome::Replaced("/assets/vendor.js".to_string()),
+            "later rewriters should not see the JS asset proxy replacement"
+        );
+        assert_eq!(
+            registry.rewrite_attribute(
+                "src",
+                "https://cdn.example.com/other.js",
+                &rewrite_context()
+            ),
+            crate::integrations::AttributeRewriteOutcome::Replaced(
+                "https://cdn.example.com/other.js?chained?chained".to_string()
+            ),
+            "other replacements should keep chaining"
+        );
+    }
+
     #[test]
     fn blocked_js_asset_proxy_entry_removes_prebid_script() {
         let processed = process_prebid_script_with_asset_mode("blocked");